registry / @nstechhub/corporate-ns-flow-kit / 1.7.0

@nstechhub/corporate-ns-flow-kit@1.7.0

Agent-Driven Lifecycle Kit para sistemas legados — agentes executam, humanos decidem.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 127 KB of source, external domains: api.movidesk.com, cli.github.com, dev.azure.com, docs.astral.sh, github.com

Source & flagged code

3 flagged

bin/cli.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2'use strict';

4const fs = require('fs');

5const os = require('os');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L3

6const path = require('path');

7const readline = require('node:readline/promises');

8const { execSync } = require('child_process');

10const KIT_ROOT = path.resolve(__dirname, '..');

11const PKG = require('../package.json');

13// kitManaged: true → sempre atualizado (agents, commands, policies — evoluem com o kit)

14// kitManaged: false → preservado se já existir (user data: .speckit, .ns-flow, CLAUDE.md)

15// --force sobrescreve tudo, incluindo user-owned

16// Nota: .claude/ é tratado separadamente (copyClaudeDir) porque suas subpastas

17// agents/ e commands/ podem ir para user-scope (~/.claude/) conforme installScope.

18const ITEMS = [

19 { name: '.cursor', type: 'dir', kitManaged: true }, // adapters Cursor (rules/*.mdc) — apontam para .claude/

20 { name: 'scripts', type: 'dir', kitManaged: true }, // bootstrap e init scripts

21 { name: 'docs', type: 'dir', kitManaged: true }, // guias de onboarding do kit

22 { name: 'tools', type: 'dir', kitManaged: true }, // wrappers SAST (semgrep, veracode) [v1.2.0]

23 { name: '.github/copilot-instructions.md', type: 'file' }, // adapter GitHub Copilot — apontam para .claude/

tools/semgrep/Run-SemgrepScan.ps1View file

•path = tools/semgrep/Run-SemgrepScan.ps1 kind = build_helper sizeBytes = 6075 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tools/semgrep/Run-SemgrepScan.ps1View on unpkg

.speckit/known-issues/cwe-catalog.mdView file

Lines 348-388markdown

348*(preenchido pelo learning-agent)*

349

350---

351

352## CWE-798 — Use of Hard-coded Credentials

353

354### Onde mora

355- Connection strings em código (`"Server=...;User=sa;Password=..."`)

356- API keys em código (`const apiKey = "AKIA..."`)

Source & flagged code

3 flagged · loading source

bin/cli.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code